Cybersecurity Engineer – Elastic SIEM (Journeyman)

Maximus

7d • $120,000 - $140,000 • Onsite

About The Position

Maximus is seeking a Cybersecurity Engineer – Elastic SIEM (Journeyman) to administer and sustain the Elastic SIEM platform across NIPRNet, SIPRNet, and JWICS environments. The role is onsite five days a week in San Antonio, Texas, and requires an active Top Secret / SCI (TS/SCI) security clearance. The engineer independently handles standard SIEM engineering tasks with limited supervision and escalates complex issues to senior engineers.

The position supports defensive cyber operations (DCO) and Cyber Security Service Provider (CSSP) activities. It involves platform health monitoring, capacity planning, outage response, detection engineering, log-data ingestion and validation, and collaboration with cyber operators and analysts. The engineer also documents procedures and participates in Agile/SAFe planning and sprint execution, while following applicable Air Force, DoD, and Intelligence Community policies and directives.

The role is classified as TCS057, T3, Band 6. Maximus offers health insurance, life and disability insurance, a retirement savings plan, paid holidays, and paid time off. The stated annual salary range is $120,000 to $140,000; compensation depends on factors including location, qualifications, experience, contract value, and other considerations.

Requirements

• Active Top Secret / SCI (TS/SCI) security clearance.
• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or a related field, or equivalent experience.
• At least 5 years of hands-on cybersecurity engineering experience.
• Intermediate proficiency: ability to independently administer and troubleshoot standard Elastic SIEM operations and escalate complex issues.
• Demonstrated hands-on experience with the Elastic Stack (Elasticsearch, Kibana, Logstash, Beats/Elastic Agent) in an operational SIEM environment.
• Experience supporting threat detection, alert triage, and/or cyber incident investigation.
• Familiarity with DCO concepts, CSSP operations, and defensive cyber frameworks.
• Experience working across multiple network security domains, such as NIPR, SIPR, or JWICS.
• Meet applicable DoD 8140 requirements for the assigned work role: DCWF 521, Cyber Defense Infrastructure Support Specialist, Intermediate Proficiency; specific required certifications are pending contract confirmation.

Nice To Haves

• Experience with SIEM/SOAR integrations, such as Elastic, Palo Alto Cortex XSOAR, or similar.
• Familiarity with Elastic Fleet/Agent management and integration development.
• Experience with AWS GovCloud environments (IL4/IL5/IL6).
• Knowledge of the MITRE ATT&CK framework and its application to detection engineering.
• Experience with scripting and automation, including Python, Bash, KQL, or EQL, for SIEM rule development and data pipeline management.
• Familiarity with container-based deployments such as Kubernetes/EKS in classified environments.
• Prior experience supporting USAF or DoD DCO programs.
• One or more preferred certifications: Elastic Certified Engineer, CompTIA CySA+, GCIA, or GCIH.

Responsibilities

• Independently perform standard SIEM engineering tasks with limited supervision and escalate complex issues to senior engineers.
• Administer, operate, and sustain Elastic SIEM—including Elasticsearch, Kibana, Logstash, and Beats/Elastic Agent—across NIPRNet, SIPRNet, and JWICS environments.
• Monitor SIEM health, perform capacity planning, and resolve platform outages and degradations in accordance with defined SLAs.
• Develop, tune, and maintain Elastic detection rules, alerts, dashboards, and visualizations to support DCO mission requirements.
• Ingest, normalize, and validate log data from endpoint, network, cloud, and application telemetry sources.
• Collaborate with cyber operators and analysts on threat detection, alert triage, and cyber incident investigation workflows.
• Identify and implement improvements to SIEM coverage, data quality, and detection fidelity in coordination with the Government PMO.
• Support CSSP activities, including continuous monitoring and security event analysis.
• Create and maintain technical documentation, including runbooks, standard operating procedures, and knowledge base articles.
• Participate in Agile/SAFe Program Increment planning and sprint execution in support of platform delivery.
• Follow Air Force cybersecurity standards and applicable DoD, IC, and USAF policies and directives across all enclaves.

Benefits

• Health insurance coverage
• Life insurance
• Disability insurance
• Retirement savings plan
• Paid holidays
• Paid time off
• Short- and long-term incentives and program-specific awards may also be available.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level